@astrale-os/sdk 0.6.0-beta.17 → 0.6.0-beta.19

package/README.md

@@ -42,7 +42,7 @@ The command covers the workspace root and its packages, pins exact versions, and
 lockfile through pnpm. Use `--channel latest` to select that tag instead. Missing tags and local,
 catalog, or aliased dependencies are left unchanged and reported; peers and overrides are not edited.
 For an older SDK without this command, start with `pnpm dlx @astrale-os/sdk@beta upgrade`.
-Stop development watchers first, then run the project's checks and validate on development.
+Run the project's checks and validate on development.
 Nothing is committed or deployed. A Shell update also requires checking the installed Shell revision.
 Rerunning an upgrade synchronizes installation even when the manifest versions are already current.
 

package/dist/deployment/adapter/legacy/index.d.ts

@@ -7,8 +7,8 @@
  * `placement` and `deployRelease`, which deploys one sealed release as one immutable deployment,
  * created or reused, and installs nothing.
  *
- * Short-term consumers: the legacy direct-mode path (CT33), which `astrale-domain deploy` and
- * `astrale-domain dev` run through these operations: adapter-cloudflare direct mode (`route`,
+ * Short-term consumers: the legacy direct-mode path (CT33), which `astrale-domain deploy`
+ * runs through these operations: adapter-cloudflare direct mode (`route`,
  * `workerName`, `identityIssuer`, `addressing`, `signingIdentity`, or no `namespace`), which serves
  * the configurations of domains ai-gateway, closing, grc, integrations and issues (until SV15),
  * domains organization (until it leaves direct mode, AM-147), the Services `beta` and `prod` (until

package/dist/deployment/adapter/legacy/prepare/context.d.ts

@@ -11,9 +11,8 @@ export interface PrepareContext<BuildValue extends Build = Build> {
     readonly projectDir: string;
     readonly environment: string;
     /**
-     * Preparation purpose. Remote development and one-shot deployment both
-     * prepare complete release artifacts. Omitted by older custom callers means
-     * release for compatibility during the beta migration.
+     * Preparation purpose. One-shot deployment prepares complete release artifacts. Omitted by
+     * older custom callers means release for compatibility during the beta migration.
      */
     readonly mode?: 'release';
     /**
@@ -27,8 +26,8 @@ export interface PrepareContext<BuildValue extends Build = Build> {
     readonly runtime: ResolvedRuntimeReference;
     /**
      * The environment-free Bundle of the adapter's own `bundler`, which `astrale-domain deploy`
-     * always produces first so that preparation only places it. Absent (an `astrale-domain dev`
-     * rebuild), the adapter bundles by itself. Legacy prepare/deploy surface: deleted with it.
+     * always produces first so that preparation only places it. Absent for a custom caller, the
+     * adapter bundles by itself. Legacy prepare/deploy surface: deleted with it.
      */
     readonly bundle?: Bundle<BuildValue>;
 }

package/dist/execution/identity/jwks.js

@@ -8,6 +8,17 @@ const MAXIMUM_DISCOVERY_BYTES = 256 * 1024;
 const MAXIMUM_VERIFICATION_BASES = 64;
 const VERIFICATION_BASIS_TTL_MS = 60_000;
 const UNKNOWN_KEY_REFRESH_COOLDOWN_MS = 60_000;
+const DISCOVERY_RETRY_DELAY_MS = 250;
+// Only typed transport failures are replayable. Browser TypeError, TLS, HTTP and document
+// admission failures carry no evidence that repeating the request can safely recover.
+const TRANSIENT_TRANSPORT_CODES = new Set([
+    'ENOTFOUND',
+    'EAI_AGAIN',
+    'ECONNRESET',
+    'ETIMEDOUT',
+    'UND_ERR_CONNECT_TIMEOUT',
+    'UND_ERR_SOCKET',
+]);
 /**
  * Retain only recently admitted public issuer material for one execution Identity.
  * An unseen key ID may refresh once per cooldown; failures never replace a usable basis.
@@ -220,21 +231,55 @@ async function discover(issuer, fetch, signal, policy) {
     });
 }
 async function request(fetch, url, signal) {
-    try {
-        const response = await fetch(url, { method: 'GET', redirect: 'error', signal });
-        if (!response.ok) {
-            await response.body?.cancel();
-            throw new IssuerUnavailable(`Issuer discovery returned HTTP ${response.status}.`);
+    for (let attempt = 0;; attempt += 1) {
+        signal.throwIfAborted();
+        try {
+            const response = await fetch(url, { method: 'GET', redirect: 'error', signal });
+            if (!response.ok) {
+                await response.body?.cancel();
+                throw new IssuerUnavailable(`Issuer discovery returned HTTP ${response.status}.`);
+            }
+            return response;
+        }
+        catch (cause) {
+            if (signal.aborted)
+                throw signal.reason;
+            if (cause instanceof IssuerUnavailable)
+                throw cause;
+            // One retry belongs to the shared issuer load, never to each observer or business call.
+            if (attempt !== 0 || !transientTransport(cause)) {
+                throw new IssuerUnavailable('Issuer discovery request failed.', cause);
+            }
+            await retryDelay(signal);
         }
-        return response;
     }
-    catch (cause) {
-        if (signal.aborted)
-            throw signal.reason;
-        if (cause instanceof IssuerUnavailable)
-            throw cause;
-        throw new IssuerUnavailable('Issuer discovery request failed.', cause);
+}
+function transientTransport(cause) {
+    // Node fetch wraps its transport Error; Bun may expose the code directly. Bound traversal
+    // of an external cause chain, including cycles, and do not look past a classified refusal.
+    for (let depth = 0; depth < 4; depth += 1) {
+        if (cause === null || typeof cause !== 'object')
+            return false;
+        const code = Reflect.get(cause, 'code');
+        if (typeof code === 'string')
+            return TRANSIENT_TRANSPORT_CODES.has(code);
+        cause = Reflect.get(cause, 'cause');
     }
+    return false;
+}
+function retryDelay(signal) {
+    signal.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        const cancel = () => {
+            clearTimeout(timer);
+            reject(signal.reason);
+        };
+        const timer = setTimeout(() => {
+            signal.removeEventListener('abort', cancel);
+            resolve();
+        }, DISCOVERY_RETRY_DELAY_MS);
+        signal.addEventListener('abort', cancel, { once: true });
+    });
 }
 async function json(response, signal) {
     const bytes = new Uint8Array(await response.arrayBuffer());

package/dist/platform/schema/property.d.ts

@@ -3,6 +3,11 @@ import { type Property as CanonicalProperty, type ValueSchemaInput } from '@astr
 export interface PropertyOptions {
     readonly required?: boolean;
     readonly description?: string;
+    /**
+     * `create` freezes the value when its node or edge is created. `once` admits one write while the
+     * value is absent; neither can be changed or unset afterwards, only removed with the element.
+     */
+    readonly immutable?: 'create' | 'once';
 }
 /** Keep canonical generic inference: ordinary properties carry no state machine. */
 export type AuthoredProperty<Schema extends ValueSchemaInput, Options extends PropertyOptions = Record<never, never>> = CanonicalProperty<Schema, Options, never>;

package/dist/tooling/cli/arguments.d.ts

@@ -1,6 +1,6 @@
 import type { LintReportFormat } from '../linter/index.js';
 import { type Version } from '../../platform/versioning/index.js';
-export declare const COMMANDS: readonly ['dev', 'build', 'deploy', 'diff', 'list', 'publish', 'test', 'lint', 'package', 'upgrade', 'yank'];
+export declare const COMMANDS: readonly ['build', 'deploy', 'diff', 'list', 'publish', 'test', 'lint', 'package', 'upgrade', 'yank'];
 export type Command = (typeof COMMANDS)[number];
 export interface ParsedArgs {
     readonly command: Command;
@@ -8,9 +8,7 @@ export interface ParsedArgs {
     readonly fix?: boolean;
     readonly format?: LintReportFormat;
     readonly identity?: string;
-    readonly credentialFile?: string;
     readonly suite?: string;
-    readonly secretsFile?: string;
     readonly channel?: string;
     readonly check?: boolean;
     readonly json?: boolean;

package/dist/tooling/cli/arguments.js

@@ -1,8 +1,6 @@
-import { isAbsolute, normalize } from 'node:path';
 import { acceptVersion } from '../../platform/versioning/index.js';
 import { installCommand } from '../../project/install-command.js';
 export const COMMANDS = [
-    'dev',
     'build',
     'deploy',
     'diff',
@@ -24,8 +22,6 @@ export function parseArgs(argv) {
     const json = rest.includes('--json');
     const undo = rest.includes('--undo');
     const allowDirty = rest.includes('--allow-dirty');
-    let secretsFile;
-    let credentialFile;
     let identity;
     let suite;
     let format;
@@ -34,19 +30,7 @@ export function parseArgs(argv) {
     const cleaned = [];
     for (let index = 0; index < rest.length; index += 1) {
         const argument = rest[index];
-        if (argument === '--credential-file') {
-            credentialFile = absoluteFilePath('--credential-file', rest[++index]);
-        }
-        else if (argument.startsWith('--credential-file=')) {
-            credentialFile = absoluteFilePath('--credential-file', argument.slice('--credential-file='.length));
-        }
-        else if (argument === '--secrets-file') {
-            secretsFile = absoluteFilePath('--secrets-file', rest[++index]);
-        }
-        else if (argument.startsWith('--secrets-file=')) {
-            secretsFile = absoluteFilePath('--secrets-file', argument.slice('--secrets-file='.length));
-        }
-        else if (argument === '--as') {
+        if (argument === '--as') {
             identity = requiredValue('--as', rest[++index]);
         }
         else if (argument.startsWith('--as=')) {
@@ -110,28 +94,20 @@ export function parseArgs(argv) {
     if (format !== undefined && command !== 'lint') {
         throw new Error('`--format` is only valid for `lint`.');
     }
-    if ((credentialFile !== undefined || secretsFile !== undefined) && command !== 'dev') {
-        throw new Error('`--credential-file` and `--secrets-file` are only valid for `dev`.');
-    }
-    if (identity !== undefined && credentialFile !== undefined) {
-        throw new Error('Choose either `--as` or `--credential-file`, not both.');
-    }
-    if (deployOnly && command !== 'dev' && command !== 'deploy')
+    if (deployOnly && command !== 'deploy')
         refuseDeployOnly(undefined);
     if (identity !== undefined &&
-        command !== 'dev' &&
         command !== 'deploy' &&
         command !== 'diff' &&
         command !== 'list' &&
         command !== 'publish') {
-        throw new Error('`--as` is only valid for `dev`, `deploy`, `diff`, `list` or `publish`.');
+        throw new Error('`--as` is only valid for `deploy`, `diff`, `list` or `publish`.');
     }
     if (environment !== undefined &&
-        command !== 'dev' &&
         command !== 'deploy' &&
         command !== 'list' &&
         command !== 'test') {
-        throw new Error('`--environment` is only valid for `dev`, `deploy`, `list` or `test`.');
+        throw new Error('`--environment` is only valid for `deploy`, `list` or `test`.');
     }
     if (suite !== undefined && command !== 'test') {
         throw new Error('`--suite` is only valid for `test`.');
@@ -141,12 +117,11 @@ export function parseArgs(argv) {
         throw new Error('Choose either a positional Environment or `--environment`, not both.');
     }
     switch (command) {
-        case 'dev':
         case 'deploy': {
             if (positionals.length > 1) {
                 throw new Error(`\`${command}\` accepts exactly one Environment.`);
             }
-            const env = environment ?? positionals[0] ?? (command === 'dev' ? 'development' : undefined);
+            const env = environment ?? positionals[0];
             if (!env) {
                 throw new Error(`\`${command}\` requires an Environment, e.g. \`${command} development\`.`);
             }
@@ -157,8 +132,6 @@ export function parseArgs(argv) {
                 env,
                 ...(json ? { json: true } : {}),
                 ...(identity === undefined ? {} : { identity }),
-                ...(credentialFile === undefined ? {} : { credentialFile }),
-                ...(secretsFile === undefined ? {} : { secretsFile }),
             };
         }
         case 'list':
@@ -278,10 +251,3 @@ function requiredValue(flag, input) {
         throw new Error(`${flag} needs a value.`);
     return input;
 }
-function absoluteFilePath(flag, input) {
-    const value = requiredValue(flag, input);
-    if (!isAbsolute(value) || normalize(value) !== value) {
-        throw new Error(`${flag} needs a normalized absolute path, got "${value}"`);
-    }
-    return value;
-}

package/dist/tooling/cli/bun.d.ts

@@ -10,6 +10,5 @@ export type BunOutcome = {
 };
 /** Re-enter the published executable under Bun only when authored TypeScript must be imported. */
 export declare function runWithBun(executable: string, argv: readonly string[]): Promise<BunOutcome>;
-export declare function isolateDevelopmentProcessGroup(argv: readonly string[], platform?: NodeJS.Platform): boolean;
 /** Prefer the generated project's exact Bun package binary over an ambient executable or shim. */
 export declare function resolveBunExecutable(cwd: string): string;

package/dist/tooling/cli/bun.js

@@ -14,10 +14,6 @@ export function runWithBun(executable, argv) {
     return new Promise((resolve, reject) => {
         const child = spawn(resolveBunExecutable(process.cwd()), [executable, ...argv], {
             stdio: 'inherit',
-            // Keep a long-lived development runtime outside the launcher's terminal
-            // process group. The launcher receives Ctrl-C, forwards it exactly once,
-            // and remains alive until Bun finishes provider and Kernel cleanup.
-            detached: isolateDevelopmentProcessGroup(argv),
         });
         const handlers = FORWARDED_SIGNALS.map((signal) => [signal, () => child.kill(signal)]);
         for (const [signal, handler] of handlers)
@@ -44,9 +40,6 @@ export function runWithBun(executable, argv) {
         });
     });
 }
-export function isolateDevelopmentProcessGroup(argv, platform = process.platform) {
-    return platform !== 'win32' && argv[0] === 'dev';
-}
 /** Prefer the generated project's exact Bun package binary over an ambient executable or shim. */
 export function resolveBunExecutable(cwd) {
     const projectRequire = createRequire(join(cwd, 'package.json'));

package/dist/tooling/cli/deploy-mode.d.ts

@@ -40,7 +40,7 @@ export type LegacyDirectReason =
 };
 export type CloudflareDirectParameter = 'route' | 'workerName' | 'identityIssuer' | 'addressing' | 'signingIdentity';
 export interface DeployRefusal {
-    readonly reason: 'astrale-instance' | 'astrale-signing-identity' | 'mixed-parameters' | 'scheduled-triggers' | 'development-canonical' | 'publish-legacy-direct';
+    readonly reason: 'astrale-instance' | 'astrale-signing-identity' | 'mixed-parameters' | 'scheduled-triggers' | 'publish-legacy-direct';
     /** The configuration or command to write instead, for the author. */
     readonly guidance: string;
 }
@@ -48,7 +48,7 @@ export interface DeployRefusal {
  * The commands that select a deploy mode. `publish` names only an immutable deployment, so it
  * refuses every Environment that is not canonical (CT33, R-G03).
  */
-export type DeployModeCommand = 'deploy' | 'dev' | 'publish';
+export type DeployModeCommand = 'deploy' | 'publish';
 /**
  * Select the deploy mode of one Environment (CT33). It reads the configuration and the command
  * only, and has no effect.
@@ -58,8 +58,8 @@ export type DeployModeCommand = 'deploy' | 'dev' | 'publish';
  * before any effect, since their one consumer pins an older SDK (AM-72). Otherwise the Environment
  * is on the legacy direct-mode path when adapter-cloudflare names a direct-mode parameter or no
  * `namespace`, or when its adapter declares no `deployRelease`. Everything else is canonical,
- * except under `dev`, which serves the legacy direct-mode path only. `publish` refuses the legacy
- * direct-mode path: a stable target serves no release, so no version can name it.
+ * and `publish` refuses the legacy direct-mode path: a stable target serves no release, so no
+ * version can name it.
  *
  * Within canonical adapter-cloudflare (with `namespace`), a direct-mode parameter is refused
  * rather than silently selecting either mode, and so is `wrangler.triggers`: an immutable

package/dist/tooling/cli/deploy-mode.js

@@ -22,8 +22,8 @@ const CLOUDFLARE_DIRECT_PARAMETERS = [
  * before any effect, since their one consumer pins an older SDK (AM-72). Otherwise the Environment
  * is on the legacy direct-mode path when adapter-cloudflare names a direct-mode parameter or no
  * `namespace`, or when its adapter declares no `deployRelease`. Everything else is canonical,
- * except under `dev`, which serves the legacy direct-mode path only. `publish` refuses the legacy
- * direct-mode path: a stable target serves no release, so no version can name it.
+ * and `publish` refuses the legacy direct-mode path: a stable target serves no release, so no
+ * version can name it.
  *
  * Within canonical adapter-cloudflare (with `namespace`), a direct-mode parameter is refused
  * rather than silently selecting either mode, and so is `wrangler.triggers`: an immutable
@@ -94,19 +94,6 @@ export function selectDeployMode(input) {
     }
     if (reasons.length > 0)
         return Object.freeze({ kind: 'legacy-direct', reasons: freeze(reasons) });
-    if (command === 'dev') {
-        return Object.freeze({
-            kind: 'refused',
-            refusals: freeze([
-                {
-                    reason: 'development-canonical',
-                    guidance: `\`astrale-domain dev\` serves only legacy direct-mode Environments, and ${environment} ` +
-                        `deploys immutable deployments. Run \`astrale-domain deploy ${environment}\`, then ` +
-                        `\`${installCommand()}\`.`,
-                },
-            ]),
-        });
-    }
     return Object.freeze({ kind: 'canonical' });
 }
 /**

package/dist/tooling/cli/help.js

@@ -14,13 +14,12 @@ export function helpText(command) {
 export const ERROR_USAGE = `Usage: astrale-domain <command> [options]
 Run "astrale-domain --help" for available commands.
 `;
-const GLOBAL_HELP = `Build, develop, deploy, list, test, lint, and package Astrale Domains.
+const GLOBAL_HELP = `Build, deploy, list, test, lint, and package Astrale Domains.
 
 Usage:
   astrale-domain <command> [options]
 
 Commands:
-  dev [environment]       Deprecated: use deploy, then astrale domain install.
   build                   Build, verify and print the build digest.
   deploy <environment>    Deploy one Environment; never installs.
   diff                    Show the changes since the published version and the minimum.
@@ -57,55 +56,9 @@ Behavior:
   unchanged with a warning.
   Local links, catalogs, aliases, peers, and overrides are not rewritten.
   Does not load astrale.config.ts, require Bun, run project checks, commit, or deploy.
-  Stop development watchers before upgrading. Review changes and run your project's
-  checks afterwards. Failed installations leave local changes available for repair.
+  Review changes and run your project's checks afterwards. Failed installations leave
+  local changes available for repair.
   For an older SDK without this command: pnpm dlx @astrale-os/sdk@beta upgrade.
-`,
-    dev: `Build, verify, remotely deploy, and watch one Project Environment (deprecated).
-
-Usage:
-  astrale-domain dev [environment] [options]
-
-Deprecated:
-  Development is not a command of the deployment model. Deploy the Environment with
-  astrale-domain deploy <environment>, then install the URL it prints with
-  astrale domain install <url> --direct -i <instance>. dev keeps its behavior until
-  it is removed and warns on every run.
-
-Arguments:
-  environment             Project Environment name; defaults to development.
-
-Options:
-  --environment <name>    Select the environment without a positional argument.
-  --as <identity>         Select the Astrale identity for the adapter's provider calls.
-  --credential-file <path>
-                          Use one private operator credential for the adapter's provider
-                          calls without exposing it in Project configuration.
-  --secrets-file <path>   Load one private, absolute secrets file for this development
-                          session instead of the adapter-declared secrets file.
-  -h, --help              Show help for dev.
-
-Behavior:
-  The selected Environment must exist; no other Environment is chosen as a fallback.
-  Builds and verifies the Domain, Runtime, frontend, and adapter artifact, then
-  deploys it through the selected Environment. It never starts a local Worker,
-  Vite server, or tunnel, and never installs the Domain: install the URL it prints with
-  ${installCommand()}. Imported source changes
-  produce serialized remote updates; configuration changes require restarting the
-  command. It serves only legacy direct-mode Environments; an Environment that
-  deploys immutable deployments is refused.
-  A shared direct-provider target additionally requires an external single-writer
-  boundary such as a CI/CD concurrency group.
-  A credential file is admitted and read once. Its value is passed only to the
-  deployment adapter; it never enters Domain Runtime secrets or diagnostics. It is
-  currently unavailable on Windows because private no-reparse file admission is
-  absent.
-  A secrets-file override is read once, passed to the Domain runtime as secrets,
-  never mutates the authored project, and is not watched for later changes. It is
-  also unavailable on Windows because private no-reparse admission is absent.
-
-  Stopping the watcher stops only local build orchestration. The remote deployment
-  remains available.
 `,
     build: `Build and verify a Domain without deploying it, and print its build digest.
 

package/dist/tooling/cli/index.d.ts

@@ -1,8 +1,7 @@
 /**
  * `@astrale-os/sdk/cli` — the `astrale-domain` CLI
- * (dev | build | deploy | diff | list | publish | test | lint | package | yank), its JSON results,
+ * (build | deploy | diff | list | publish | test | lint | package | upgrade | yank), its JSON results,
  * the deploy mode each command selects for an Environment (CT33), and the explicit dotenv boundary.
- * `dev` is deprecated and lives in `legacy/development/`.
  *
  * Node-only: the CLI imports `node:fs`/`node:module`/`node:url` and runs under
  * Bun (it imports the project's `astrale.config.ts` directly). This subpath is

package/dist/tooling/cli/index.js

@@ -1,8 +1,7 @@
 /**
  * `@astrale-os/sdk/cli` — the `astrale-domain` CLI
- * (dev | build | deploy | diff | list | publish | test | lint | package | yank), its JSON results,
+ * (build | deploy | diff | list | publish | test | lint | package | upgrade | yank), its JSON results,
  * the deploy mode each command selects for an Environment (CT33), and the explicit dotenv boundary.
- * `dev` is deprecated and lives in `legacy/development/`.
  *
  * Node-only: the CLI imports `node:fs`/`node:module`/`node:url` and runs under
  * Bun (it imports the project's `astrale.config.ts` directly). This subpath is

package/dist/tooling/cli/legacy/stable-target-adapter.d.ts

@@ -4,7 +4,7 @@ import type { Adapter, LegacyAdapter } from '../../../deployment/adapter/index.j
  * v2 that keeps `prepare` and `deploy` for its direct-mode Environments.
  *
  * @deprecated Stable-target deploy path only. Replacement: `deployRelease` of adapter interface
- * v2. Consumers: `astrale-domain deploy` and `astrale-domain dev` on the direct-mode
+ * v2. Consumers: `astrale-domain deploy` on the direct-mode
  * configurations of domains ai-gateway, closing, grc, integrations and issues (until SV15), domains
  * organization (until it leaves direct mode, AM-147), the Services `beta` and `prod` (until SV12),
  * `development` (until SV9) and frozen `admin-beta` (until D19) environments, shell (until SH2)

package/dist/tooling/cli/orchestrate.d.ts

@@ -1,7 +1 @@
-import { type ParsedArgs } from './arguments.js';
-import { develop } from './legacy/development/index.js';
 export declare function run(argv: readonly string[]): Promise<number>;
-export declare function executeDevelopmentCommand(parsed: ParsedArgs, input: {
-    readonly configPath: string;
-    readonly projectDir: string;
-}, execute?: typeof develop): Promise<number>;

package/dist/tooling/cli/orchestrate.js

@@ -10,7 +10,6 @@ import { deprecationWarnings } from './deprecations.js';
 import { runDiff } from './diff/index.js';
 import { ERROR_USAGE, helpRequest, helpText } from './help.js';
 import { deployImmutable } from './immutable-deployment.js';
-import { develop, developmentDeprecation } from './legacy/development/index.js';
 import { deployStableTarget } from './legacy/stable-target-deploy.js';
 import { listDeployments, renderDeploymentList } from './list.js';
 import { error, info, progress, warn } from './log.js';
@@ -56,10 +55,6 @@ export async function run(argv) {
     if (!process.versions.bun) {
         throw new BunRequiredError();
     }
-    // Under Bun, before any Project prerequisite, so a refused `dev` run still names its
-    // replacement. The Node launcher re-enters Bun through BunRequiredError, so it prints once.
-    if (parsed.command === 'dev')
-        warn(developmentDeprecation(parsed.env));
     const projectDir = process.cwd();
     const configPath = findConfig(projectDir);
     if (configPath === undefined) {
@@ -71,17 +66,6 @@ export async function run(argv) {
         return list(parsed, project, projectDir);
     if (parsed.command === 'yank')
         return yank(parsed, project);
-    if (parsed.command === 'dev') {
-        // `dev` deploys only legacy direct-mode Environments; any other is refused before any effect.
-        const mode = selectDeployMode({
-            command: 'dev',
-            environment: parsed.env,
-            definition: selectEnvironment(project, parsed.env),
-        });
-        if (refused(mode))
-            return 1;
-        return executeDevelopmentCommand(parsed, { configPath, projectDir });
-    }
     if (parsed.command === 'publish') {
         // A version names an immutable deployment's release: any other Environment is refused before
         // anything is built (CT33, R-G03).
@@ -299,18 +283,6 @@ function refused(mode) {
         error(refusal.guidance);
     return true;
 }
-export function executeDevelopmentCommand(parsed, input, execute = develop) {
-    if (parsed.command !== 'dev')
-        throw new TypeError('Development execution requires the dev command.');
-    return execute({
-        configPath: input.configPath,
-        projectDir: input.projectDir,
-        environment: parsed.env,
-        ...(parsed.identity === undefined ? {} : { identity: parsed.identity }),
-        ...(parsed.credentialFile === undefined ? {} : { credentialFile: parsed.credentialFile }),
-        ...(parsed.secretsFile === undefined ? {} : { secretsFile: parsed.secretsFile }),
-    });
-}
 /**
  * `astrale-domain yank <version> [--undo]`: take one published version of the Project's Domain
  * out of resolution in the Admin registry, or put it back. With `--json`, stdout carries only the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/sdk",
-  "version": "0.6.0-beta.17",
+  "version": "0.6.0-beta.19",
   "description": "Schema-first SDK for defining, composing, and deploying Astrale domains",
   "keywords": [
     "astrale",
@@ -253,11 +253,11 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@astrale-os/kernel-client": "0.6.0-beta.84",
-    "@astrale-os/kernel-core": "0.9.0-beta.63",
-    "@astrale-os/kernel-dsl": "0.2.0-beta.45",
-    "@astrale-os/kernel-protocol": "0.5.0-beta.69",
-    "@astrale-os/kernel-server": "0.5.0-beta.71",
+    "@astrale-os/kernel-client": "0.6.0-beta.85",
+    "@astrale-os/kernel-core": "0.9.0-beta.64",
+    "@astrale-os/kernel-dsl": "0.2.0-beta.46",
+    "@astrale-os/kernel-protocol": "0.5.0-beta.70",
+    "@astrale-os/kernel-server": "0.5.0-beta.72",
     "@lucide/icons": "1.34.0",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
     "cross-spawn": "7.0.6",
@@ -333,7 +333,7 @@
     "e2e": "node __e2e__/flagship/runner.mjs",
     "typecheck": "tsgo --noEmit && pnpm run typecheck:workers && pnpm run typecheck:specs && pnpm run typecheck:types && pnpm run typecheck:tests && pnpm run typecheck:e2e && pnpm run typecheck:knowledge",
     "typecheck:workers": "tsgo --noEmit -p tsconfig.workers.json",
-    "typecheck:specs": "tsgo --noEmit -p src/application/query/.spec/tsconfig.json && tsgo --noEmit -p src/platform/schema/.spec/tsconfig.json && tsgo --noEmit -p src/application/mutation/.spec/tsconfig.json && tsgo --noEmit -p src/tooling/cli/.spec/tsconfig.json && tsgo --noEmit -p src/tooling/cli/legacy/development/.spec/tsconfig.json",
+    "typecheck:specs": "tsgo --noEmit -p src/application/query/.spec/tsconfig.json && tsgo --noEmit -p src/platform/schema/.spec/tsconfig.json && tsgo --noEmit -p src/application/mutation/.spec/tsconfig.json && tsgo --noEmit -p src/tooling/cli/.spec/tsconfig.json",
     "typecheck:types": "tsgo --noEmit -p __tests__/tsconfig.types.json",
     "typecheck:tests": "tsgo --noEmit -p tsconfig.test.json",
     "typecheck:e2e": "tsgo --noEmit -p __e2e__/flagship/fixtures/tsconfig.v1.json && tsgo --noEmit -p __e2e__/flagship/fixtures/tsconfig.json",

package/dist/tooling/cli/legacy/development/candidate.d.ts

@@ -1,25 +0,0 @@
-import type { PreparedArtifact } from '../../../../deployment/adapter/index.js';
-import type { StableTargetAdapter } from '../stable-target-adapter.js';
-export interface DevelopmentCandidate {
-    readonly adapter: StableTargetAdapter<object>;
-    readonly parameters: object;
-    readonly artifact: PreparedArtifact;
-    readonly secrets: Readonly<Record<string, string>>;
-    readonly sources: ReadonlySet<string>;
-}
-/** Rebuild one complete, isolated Environment candidate from authored sources. */
-export declare class DevelopmentCandidateBuilder {
-    #private;
-    constructor(input: {
-        readonly configPath: string;
-        readonly projectDir: string;
-        readonly environment: string;
-        readonly runtimePath: string;
-        readonly overrideSecrets?: Readonly<Record<string, string>>;
-    });
-    prepare(signal: AbortSignal): Promise<DevelopmentCandidate>;
-}
-export declare function discoverRuntimePath(configPath: string): Promise<string>;
-export declare function sameEnvironment(current: DevelopmentCandidate, candidate: DevelopmentCandidate): boolean;
-/** Identify a rebuilt candidate that cannot change provider state. */
-export declare function sameDeploymentCandidate(current: DevelopmentCandidate, candidate: DevelopmentCandidate): boolean;